- Aug 2, 2015
- 4,286
New “Quad9” DNS service blocks malicious domains for everyone
The Global Cyber Alliance (GCA)—an organization founded by law enforcement and research organizations to help reduce cyber-crime—has partnered with IBM and Packet Clearing House to launch a free public Domain Name Service system. That system is intended to block domains associated with botnets, phishing attacks, and other malicious Internet hosts—primarily targeted at organizations that don't run their own DNS blacklisting and whitelisting services. Called Quad9 (after the 9.9.9.9 Internet Protocol address the service has obtained), the service works like any other public DNS server (such as Google's), except that it won't return name resolutions for sites that are identified via threat feeds the service aggregates daily.
"Anyone anywhere can use it," said Phil Rettinger, GCA's president and chief operating officer, in an interview with Ars. The service, he says, will be "privacy sensitive," with no logging of the addresses making DNS requests—"we will keep only [rough] geolocation data," he said, for the purposes of tracking the spread of requests associated with particular malicious domains. "We're anonymizing the data, sacrificing on the side of privacy."
Intelligence on malicious domains comes from 19 threat feeds—one of which is IBM's X-Force. Adnan Baykal, GCA's Chief Technical Advisor, told Ars that the service pulls in these threat feeds in whatever format they are published in, and it converts them into a database that is then de-duplicated. Quad9 also generates a whitelist of domains never to block; it uses a list of the top one million requested domains. During development, Quad9 used Alexa, but now that Alexa's top million sites list is no longer being maintained, Baykal said that GCA and its partners had to turn to an alternative source for the data—the Majestic Million daily top-million sites feed.
There's also a "gold list"—domains that should never be blocked, such as major Internet service sites like Microsoft's Azure cloud, Google, and Amazon Web Services. "We do realize that docs.google.com is hosting phishing attacks," Baykal said. "But because this is DNS filtering, we cannot block that URL specifically. And we don't ever want to completely block Google."
The blocked sites, whitelist, and gold lists are then converted into a Response Policy Zone (RPZ) format before being pushed out to the clusters of DNS servers around the world maintained by Packet Clearing House via DNS zone transfers. The DNS server clusters, which are each load-balanced with dnsdist, use a mix of Unbound and PowerDNS servers to deliver responses. "We're running two different variants behind a load balancer," Baykal said, "so that if there's an issue with one we can take it down, or if there's a critical vulnerability, we can shut one down and patch it."
As of launch, there were clusters of DNS servers configured in 70 different locations around the world; Baykal said that the organization expects to have 100 sites up and running by the end of the year. Each cluster has at least three servers, Baykal explained, "and in some critical areas, like Chicago, we have five, seven, or nine systems behind load balancer." Each instance runs on a virtual machine, so additional servers can be provisioned in Packet Clearing House's infrastructure as needed. Regardless, DNS response speeds will be fast enough that the vast majority of users won't notice a difference.
If a domain name is in the block list, the service simply responds to the query with an "NXDOMAIN" (non-existant domain) message. "It will break DNS queries," Rettinger said, "but it tends to work better than sinkholing"—the practice of forwarding bad domains to a host controlled by the service, as has been done with some seized botnet domains in the past—"because if you sinkhole, you can break other things."
Since the threat feeds will be updated once or twice a day globally, Quad9 will likely not have much of an impact on malware that uses rapidly shifting DNS addresses for command and control. But it does offer a basic level of protection against domain-spoofing phishing attacks and other Web-based attacks that have been picked up by major threat feeds. And organizations can fairly easily log the responses back from Quad9 to identify systems in their own networks that may have malware or might have been targeted for phishing attacks by logging NXDOMAIN responses.
The Quad9 service is free, but it does need to be continually funded. GCA is a non-profit—so the long-term growth of the service is based largely on government and industry continuing to fund it. GCA itself was funded initially with $25 million in criminal asset forfeiture directed to the organization by Manhattan District Attorney Cyrus Vance Jr. Rettinger said that GCA is talking with other major DNS providers about how they can replicate Quad9's service, however—so there's a chance that GCA may be absorbed into the greater Internet's infrastructure.
The Global Cyber Alliance (GCA)—an organization founded by law enforcement and research organizations to help reduce cyber-crime—has partnered with IBM and Packet Clearing House to launch a free public Domain Name Service system. That system is intended to block domains associated with botnets, phishing attacks, and other malicious Internet hosts—primarily targeted at organizations that don't run their own DNS blacklisting and whitelisting services. Called Quad9 (after the 9.9.9.9 Internet Protocol address the service has obtained), the service works like any other public DNS server (such as Google's), except that it won't return name resolutions for sites that are identified via threat feeds the service aggregates daily.
"Anyone anywhere can use it," said Phil Rettinger, GCA's president and chief operating officer, in an interview with Ars. The service, he says, will be "privacy sensitive," with no logging of the addresses making DNS requests—"we will keep only [rough] geolocation data," he said, for the purposes of tracking the spread of requests associated with particular malicious domains. "We're anonymizing the data, sacrificing on the side of privacy."
Intelligence on malicious domains comes from 19 threat feeds—one of which is IBM's X-Force. Adnan Baykal, GCA's Chief Technical Advisor, told Ars that the service pulls in these threat feeds in whatever format they are published in, and it converts them into a database that is then de-duplicated. Quad9 also generates a whitelist of domains never to block; it uses a list of the top one million requested domains. During development, Quad9 used Alexa, but now that Alexa's top million sites list is no longer being maintained, Baykal said that GCA and its partners had to turn to an alternative source for the data—the Majestic Million daily top-million sites feed.
There's also a "gold list"—domains that should never be blocked, such as major Internet service sites like Microsoft's Azure cloud, Google, and Amazon Web Services. "We do realize that docs.google.com is hosting phishing attacks," Baykal said. "But because this is DNS filtering, we cannot block that URL specifically. And we don't ever want to completely block Google."
The blocked sites, whitelist, and gold lists are then converted into a Response Policy Zone (RPZ) format before being pushed out to the clusters of DNS servers around the world maintained by Packet Clearing House via DNS zone transfers. The DNS server clusters, which are each load-balanced with dnsdist, use a mix of Unbound and PowerDNS servers to deliver responses. "We're running two different variants behind a load balancer," Baykal said, "so that if there's an issue with one we can take it down, or if there's a critical vulnerability, we can shut one down and patch it."
As of launch, there were clusters of DNS servers configured in 70 different locations around the world; Baykal said that the organization expects to have 100 sites up and running by the end of the year. Each cluster has at least three servers, Baykal explained, "and in some critical areas, like Chicago, we have five, seven, or nine systems behind load balancer." Each instance runs on a virtual machine, so additional servers can be provisioned in Packet Clearing House's infrastructure as needed. Regardless, DNS response speeds will be fast enough that the vast majority of users won't notice a difference.
If a domain name is in the block list, the service simply responds to the query with an "NXDOMAIN" (non-existant domain) message. "It will break DNS queries," Rettinger said, "but it tends to work better than sinkholing"—the practice of forwarding bad domains to a host controlled by the service, as has been done with some seized botnet domains in the past—"because if you sinkhole, you can break other things."
Since the threat feeds will be updated once or twice a day globally, Quad9 will likely not have much of an impact on malware that uses rapidly shifting DNS addresses for command and control. But it does offer a basic level of protection against domain-spoofing phishing attacks and other Web-based attacks that have been picked up by major threat feeds. And organizations can fairly easily log the responses back from Quad9 to identify systems in their own networks that may have malware or might have been targeted for phishing attacks by logging NXDOMAIN responses.
The Quad9 service is free, but it does need to be continually funded. GCA is a non-profit—so the long-term growth of the service is based largely on government and industry continuing to fund it. GCA itself was funded initially with $25 million in criminal asset forfeiture directed to the organization by Manhattan District Attorney Cyrus Vance Jr. Rettinger said that GCA is talking with other major DNS providers about how they can replicate Quad9's service, however—so there's a chance that GCA may be absorbed into the greater Internet's infrastructure.
